Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 23:34
Static task
static1
Behavioral task
behavioral1
Sample
26a58e09ba7fb6ac455fe14ef8fae5f0_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
26a58e09ba7fb6ac455fe14ef8fae5f0_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
26a58e09ba7fb6ac455fe14ef8fae5f0_JaffaCakes118.html
-
Size
3KB
-
MD5
26a58e09ba7fb6ac455fe14ef8fae5f0
-
SHA1
486668c8d41a9bb519375c04640c1489cd27c6e7
-
SHA256
2c38339455e96e577960326b6692e84442420c99b1c41fb0f02f6453f216d94c
-
SHA512
8730aade1682b4bc8cc3bfaaf3518f4dd20d5a0b705fc18ccd9a2fa104a6d2e76a055b8268aa8d6dcf6be96d90632325c28aae9271df519c43bd9f434b35d06c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A243661-3AA3-11EF-95E0-F67F0CB12BFA} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000042a089dc4c89ad85a230edee4cb5b9e5d7163c4368457a679e0d4e3a75b04d3b000000000e80000000020000200000001559c26a0b1dcb59f1b396b757784ea0ba00dc5a9e82b917810c5fd8c640a82620000000fa604d8fc2fccb7e40a2b632977ce460cb0d8ec48da5050c4239eea316a1338d40000000ae40b567e3785546ef176b3abc0de5ad771e7c5e3e0c4e2c649e3ca1b5375316adaab2ee8a0cceb3ba38a6d160446cfe90a65908a6eee82a4381e6c4fac068af iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426327822" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a000df4cb0ceda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000035b9c220b614005bdbcdf529990cdf18e2ebf39f962c888dbaf68edc592ceae000000000e800000000200002000000020284ef3186f348cd72cc0d12f4b4418e6ba1bbeb03daa0d4ad5981d2d6594d9900000003cf73e85817d46121ed2f29ffddea4484a305144ccaa156c9a5f0fb9b0ff5c989ae2f37e3841b35faa351ac51c0d1a97261f4083f98a6fa69b159e489ea03a54ca2c63369f2ed97bb15380e52e0f9f9fa724463186053062edefef04cf8f2ca0cbfa3af6f1f8d96f74ab360ffe934359a1a82a43ce852531aa3abba676b55a81e02804dc1b7df9bddab6204aaa2e6a7c40000000285bd9b417abd9c1bafacbbbacfa821b05aef4b4b2fe6b8eb3f4d7fdb6f65c3675ec975478b16f04a0f000a93392b8df097658bd6b33a4eade27bf52fa796598 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2572 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2572 iexplore.exe 2572 iexplore.exe 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2572 wrote to memory of 2108 2572 iexplore.exe 30 PID 2572 wrote to memory of 2108 2572 iexplore.exe 30 PID 2572 wrote to memory of 2108 2572 iexplore.exe 30 PID 2572 wrote to memory of 2108 2572 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\26a58e09ba7fb6ac455fe14ef8fae5f0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cbb7d0a8a245d140d2f228f5a1036249
SHA1df85eb664d44741c0dc878c95fcfa6719295e1c7
SHA256ddfbdb66d1fcacc45ff3dfcdd75cd7d937530fc0707894ef905d67a8f5e106ed
SHA512fd9038b6f94eb8b98f0c17c4de399df4195f9547569916c9cba1d7911627f24713d3f45d29c190b1e7ca6dc2cf4ac3613f576c37af1e410fa60fa92e9e69c84c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549399108fe642520aed898eb8ee24831
SHA1ec9a321b8eb59628ebd1612242ee2b7319fc0bc7
SHA2560bbceaff338114057d0401a6431e819565101413e5ec074fe2753c2f6d111e0b
SHA5127d09435ae77e717ee270645af567084c78d4b7a04569a421dbce8397a01335838789638e4eecfcbda65b69a6ad819ec7da48f97966a0c3ac8f3c21c2144f1285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d76dd68c1e8e39dd3655918eff7770fe
SHA18117141e7ba65de466463e62e854a3f8570f93cf
SHA256ea438b080bfeb6e888fe2b3b9eb54cc20659360119c88c5b1bf74f3d6b3bb485
SHA512e0422e78a4904393df6217208a775b86d8b277c8632b718d43af6483e07788a72cc671db20f3032dac732bb61390beac9a5ec7ea1e7b0553fb0968479eed62e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ce38e3935db0c6e4039018459ffdd4f
SHA1c2515ede1da68867addbb33a3fccb6af1ad467bd
SHA256faf0a90b0f25ec469020a6cff709236eed76e32403b93436ef1f8041122ee694
SHA512f1843aa7388565237388cca34e881d65c5a17fb80ef4cdfda8060296ac635ad5f3cefe1d26f4f894cb051ed959033cf3d98e5d1ef9bc63a304a008b8ddd68f04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5efbdbf9c68f35f732c373c84171543
SHA137aefeccb420abb2b66bb3022006e3db74b1e90c
SHA256dba7031031939b8bf30bf6aa307cd73d4960d0889cfeef747cdf895e87bad828
SHA5127a68c73f026510b83016e2c9f3f010ce2c5ed303938787aecd19993dfeb3114029a9472c97b20d7f7536263995a230d88e8c90814ee403ff7ce42fca4474ee00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ae175f622af62f7b8f9a1a7a08dc14e
SHA1e4cf9e9a3913aff6ff921c69c24f1772311ffae4
SHA2561d2b017eac812e757400f8175ae484832e2c20ceba4fb1c9ee59a2e5e06a0a23
SHA5129d96c1a09ef2bd798a88af4f9699ea28a39180f3d8ba652bd79e4363c997799a6b35649b9d078237df6b84849c33eec0cd9b4c0761f6aadb6a8970a6751daf5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58117a2343843fd29acff9a1205c741e1
SHA1cbbf686d9a1c4f9af3e991d5fa974595814186f0
SHA256979ac7c8a25e70f95bb407059c8ac29bd53663292bd8da421e9d204955870c6c
SHA512c26f7ee1feafe3a54593b38a546c125a00b5100fd58a5bb73ddd1ab68016c6d69d702614ea80ef47a56e5b88087faa51d6e472fdca41d7473b2aefbb1d55249b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5757d4c623f282dcb377b3f521d57e4bb
SHA132d423ab9f44f261049d6522f26a22c6ddceba31
SHA256d2f003f535e5188a947d9ee30657dc55f38451ee1ba3712870b5786ba7cbd0a2
SHA512e3ead827587f4bb95825d39421dbebfb0a24eb2dd22f326fc4023fd03c41749ad495c67889093773762b858765dbacea731f25478e978b68b617951e5378faf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b7203a90600cff06684ada236f54c4e
SHA1c7b85b4a601c8873c9a963ca482be6f2de91ead6
SHA25635fa691a92da9c25110d1fdcfa2b7e2fd79a2050e774ec93739438741a7a0ba9
SHA51286af369cf5238909363f94a6520db09e49b8fff9c5a78c1ce5ebb61be475c946d440a812b35318aebe985dc2883be0a02e3820a70fa9ee2302191106c510a7d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a92d855f1722df152746a27e7e6a213
SHA154797c8d6096f0b5021f33805137bedfc6a6bd0f
SHA2568a83f8a189cff6641113e749bc3bc10908025dd4552b62bb4796c7906ef7c5f0
SHA512c21b3095da13d94f7cc0803800148641d70c679357c64ad9a90cc3063293d77d167c059c3996fdf67e0ea38285be46b8e80470baffe90be856e77a37b563f7d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a51cd6778f30d45c3e8e1cd73c21863
SHA1bd800dd121617841f0ce29b0fb86019477760622
SHA2569c939d5b7269625d2a359efcb16b1a62a0a5042f30b3e8fe55802735edf098fc
SHA5121437b0ab052999631070da96248cd55df7a57f72f8b5e9396f523af853a43bb3b835e081adfd156be30b1f3ff7a8a818cc2d5b0e7a60100506bb836cadeb44d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5201af6cda183e9c0142797b604f527ce
SHA18b82e0e6faf373654198ae35c08f524f7f7bdeb7
SHA256691bc0bf7638cb5d4cee12e3ea9b3b9c3be7c30f5a62042db1ed2d0801f49b96
SHA5126e337d78f9648c494fd53f7304deb1472686aac212224cc384559d1f6fce172551744cfb141c2610198d217f6a9179b13d6e61b06f29e96f3f49c7c3da0a615c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b40d671e535f222ca95d9f5c9a9009d
SHA1665a6abbabd88f967f822494e41914c98133adcc
SHA2565246925211ddee18ce883dd34f2643348e01f9c40d9d9f3ffdb8537fc03fe854
SHA512074447b092b402269eb0d680579ea5a0cd6b9485bb35abe7200ff38b35b665b7c6d6d690080e52cea95b0a17aefb34e9dcf7ff85b1947f0d11c4c9b60d2b51aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd6bb984060cfa9b01d8d48949f386f5
SHA1901e6d2ba93ae9e744898c7cb6fc5db0fe404c81
SHA256cc3e3b4ede829312be1ad12a4eaa0492b730d1f9edd38b40862569df121de83a
SHA5120d30aaadb9449a08ba94c35168fd71a1ee4e7897411f2827567ac2319dd8895fce1dbfc6daef46fefb6c769ef0e5f11f07d6b953c8d5e664beb071b73f4b4098
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580da49f55fc11b026ea40cf6e4b2a2d1
SHA1b65a7d284a4be9d94e26065a85200e194a03df49
SHA256819ec41700bef2dceb424ebded8798dae9111c7a74045febad54cb771c6620d3
SHA5124ad9d999e25b6b3d477e0d8b58342fcc1471bfa65cc25dd859a6945839a2700b3dadea427b1340b6f0ce5bae6bdec922b4b4cf395713700553e41be7463c7c69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c8e5acfb51b1c7534c70ba1ec66b290
SHA14d21e4b5f0ea31174aa2e95cb87eff6d2a30bc59
SHA256f02f4f2c05de95e0cdc46ecaed0214e51585c00e1fe817f9520320df0efe99f1
SHA512c23268197c980742567bb67f027da944693bce97ccd2eb0c697d576461178be4a78daab7f0d5346f85b912f985bf54aad8e60c1ac6a34568481d129b5fe11659
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b5e5cc33fabceed224f93eb0c31c8a0
SHA1226e441a7abda419d8e0c63b5e1b28da55e02810
SHA256558bf5bc0d3547d0ffc09a0c0dc403b004bf22aa7dd992716623985d9c146ca6
SHA5124d9b67b71b3e5901d15df11d6a2623b36bc45fdfe247a68ad739db55f6874b549cfe3d42b8226a690039134232ad634e4b3dbc2e2c10edc018fb60dcc1f71b59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50be66f4bd8bfb1acdb73702fc9d21f91
SHA16815037f652d98ecf6b432b87eccc3a7807ea3ca
SHA25668bdedb56491f5b36800a84a1a565079ea36b4eb74d2e8d799e65a524e377543
SHA5125c9baec1af3c9fdb21eac60f6af53daf2bd410ba4d666551c738b3bba72898c33755791e215c645c2fdc32b20ea61ffc27c9ed8832f95d6fe7f098858358bd51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54eff24a437a15a7363f73244f1ed2791
SHA1ba2c1de0c32ea80709bdbfa52ad9f173a80bab55
SHA25666acea9f89ca429a8652acf632094496e11b9c9360cc9781ac64cfe5ac0e90a1
SHA512436fc463cd6d05bc0240da25efa933296f69b0f73e25af8f20f8e9f0aa54238fea7aef9a7e17bdec67d5954281c6632f6b14620fd4b240099a9fe7f00c2ad24a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b